feat: 部署 sandbox SPIRE Agent 与 CSI

platform/spire/README.md

@@ -19,6 +19,11 @@ Flux 安装 SPIFFE hardened charts：
 API 或 Broker API。Trust domain 是 `ddupan.top`，Kubernetes cluster name 是
 `homelab`。
 
+同一 Server 也接受 cluster name 为 `sandbox` 的 external PSAT attestation。SPIRE gRPC
+只通过内网 `spire-server.ad.ddupan.top:8081` 暴露；external PSAT、external
+controller-manager 与 bundle publisher 使用由 sandbox Ansible bootstrap 的独立、受限
+kubeconfig。Sandbox 不运行第二套 Server 或 OIDC Provider。
+
 ## PostgreSQL bootstrap
 
 SPIRE registration datastore 使用共享 CloudNativePG：

platform/spire/values.yaml

@@ -30,6 +30,42 @@ spire-server:
   kind: statefulset
   replicaCount: 1
   auditLogEnabled: true
+  service:
+    type: LoadBalancer
+    port: 8081
+    loadBalancerIP: 192.168.10.127
+  kubeConfigs:
+    sandbox:
+      externalSecret:
+        name: spire-external-kubeconfigs
+        key: sandbox
+    sandbox-controller:
+      externalSecret:
+        name: spire-external-kubeconfigs
+        key: sandbox-controller
+  nodeAttestor:
+    externalK8sPSAT:
+      enabled: true
+      clusters:
+        sandbox:
+          kubeConfigName: sandbox
+          serviceAccountAllowList:
+            - spire-system:spire-agent
+  externalControllerManagers:
+    enabled: true
+    clusters:
+      sandbox:
+        kubeConfigName: sandbox-controller
+  bundlePublisher:
+    externalK8sConfigMap:
+      enabled: true
+      clusters:
+        sandbox:
+          kubeConfigName: sandbox-controller
+          namespace: spire-system
+          configMapName: spire-bundle
+          configMapKey: bundle.spiffe
+          format: spiffe
   persistence:
     # PostgreSQL stores registrations, but the disk KeyManager still needs durable
     # storage for the trust-domain signing keys.